Fixes issue creating new user role

since domain is not an attr of request, but we have access to domain, just check privileges directly